# Add NOW timestamp to field w/o use of @timestamp

**URL:** https://discuss.elastic.co/t/add-now-timestamp-to-field-w-o-use-of-timestamp/110773
**Category:** Logstash
**Created:** [December 7, 2017, 11:37pm UTC](https://discuss.elastic.co/t/add-now-timestamp-to-field-w-o-use-of-timestamp/110773 "2017-12-07T23:37:51Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![aaronloesattv](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@aaronloesattv](https://discuss.elastic.co/u/aaronloesattv)
#### Post date: [December 7, 2017, 11:37pm UTC](https://discuss.elastic.co/t/add-now-timestamp-to-field-w-o-use-of-timestamp/110773/1 "2017-12-07T23:37:51Z")

</div>

i've been trying to add the "@received\_at" timestamp that indicates when logstash received the log message. this helps us determine if our logging infrastructure is lagging behind our logging events. The logs we receive already have a "@timestamp" field so using the typical assignment of "@received\_at" to "@timestamp" will not work. I'm not seeing anything in the documentation about having the ability to do this. So question is it possible to add the current time to a an arbitrary field w/o referencing an existing field?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 8, 2017, 12:18am UTC](https://discuss.elastic.co/t/add-now-timestamp-to-field-w-o-use-of-timestamp/110773/2 "2017-12-08T00:18:20Z")

</div>

If I understand the ask correctly, then this should do it...

```
ruby { code => "event.set('[rightNow]', Time.now)" }
```

But logstash is adding @timestamp, right? If there is latency upstream I do not think this is going to help you find it.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 8, 2017, 7:33am UTC](https://discuss.elastic.co/t/add-now-timestamp-to-field-w-o-use-of-timestamp/110773/3 "2017-12-08T07:33:23Z")

</div>

Assigning the received timestamp in Logstash may not always be entirely accurate, as it is possible for Logstash to process an event and then have to retry sending it to Elasticsearch a number of times. It is however likely that only a limited number of events would be be affected by this. Another option might be to assign it in an ingest pipeline once it reaches Elasticsearch, as shown [in this example](https://www.elastic.co/guide/en/elasticsearch/reference/current/accessing-data-in-pipelines.html#accessing-ingest-metadata).

---

<div class="post-metadata">

### Author: ![aaronloesattv](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@aaronloesattv](https://discuss.elastic.co/u/aaronloesattv)
#### Post date: [December 8, 2017, 5:43pm UTC](https://discuss.elastic.co/t/add-now-timestamp-to-field-w-o-use-of-timestamp/110773/4 "2017-12-08T17:43:55Z")

</div>

logstash is not setting @timestamp, it is already set before being received by logstash. I will look into your ruby option. Thank you for your help.

---

<div class="post-metadata">

### Author: ![aaronloesattv](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@aaronloesattv](https://discuss.elastic.co/u/aaronloesattv)
#### Post date: [December 8, 2017, 5:45pm UTC](https://discuss.elastic.co/t/add-now-timestamp-to-field-w-o-use-of-timestamp/110773/5 "2017-12-08T17:45:08Z")

</div>

i'm not looking for the time that ES received the data but rather when logstash received the data. we often have occasional delays in log processing and having this bit of information helps us know where the problem lies.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 5, 2018, 5:45pm UTC](https://discuss.elastic.co/t/add-now-timestamp-to-field-w-o-use-of-timestamp/110773/6 "2018-01-05T17:45:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
